T01 · Skill Instruction Hijacking
Error
- Location
templates/process/INTAKE.md:32- Finding
Untrusted External Discoveries Can Become Autonomously Executed Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Team Kit
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed autonomous team-process kit, but it needs review because it encourages approval-free task execution and agent spawning from broad inputs with unclear safety boundaries.
Review before installing. Use this only in workspaces where autonomous agents are allowed to modify files and spawn work, and add your own approval gates for shell commands, deployments, package installs, credential access, public communications, deletion, and externally sourced requests. Verify the repository source and pin a reviewed commit before copying templates or appending heartbeat instructions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:68- Finding
Mutable Installation Source Conflicts with Declared Package Provenance
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Describing
STATUS.mdas 'self-updated' normalizes agent-driven modification of operational state files, and in this skill that behavior sits inside a broader self-sustaining, heartbeat-triggered team process. Self-modification of coordination artifacts can be abused to falsify status, hide actions, create feedback loops, or manipulate future agent behavior if those files are later used as trusted inputs.- Content
├── ROLES.md # Who does what ├── OPPORTUNITIES.md # Raw discoveries (anyone adds) ├── BACKLOG.md # Triaged work (Rhythm maintains) └── STATUS.md # Current activity (self-updated)
HEARTBEAT.md # Proactive check triggers
text
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md # Status *Who's working on what. Self-updated by agents.* ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README encourages autonomous, heartbeat-driven operation with broad language such as 'let it run' and 'the heartbeat keeps the loop spinning' without clearly constraining scope, approval boundaries, or allowed actions. In an agent skill context, ambiguous autonomy can cause agents to continue acting, modifying files, or spawning work beyond what a user explicitly intended.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The phrase 'No approval needed' explicitly authorizes agents to claim and execute queued work without a human confirmation step. In a multi-agent environment, this can lead to unauthorized actions, unsafe task execution, or cascading mistakes if a task was mis-triaged or maliciously inserted into the ready queue.
- Content
md ## Key Principles ### 1. Self-Service If work is in the Ready queue, any agent can pick it up. No approval needed. First claim wins. ### 2. Clear Ownership Every phase has ONE owner. No "shared responsibility" (which means no responsibility).
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documented workflow centers on logging discoveries, triaging work, and maintaining process files in the workspace, but it does not warn users that the system may create or modify files continuously as part of autonomous operation. That omission is risky because users may enable the skill expecting coordination help, while the agent is implicitly encouraged to persist data and change workspace state over time.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The skill explicitly authorizes agents to pick up and execute work with 'No approval needed,' which enables autonomous task selection without a human checkpoint. In an agent framework, that can lead to unreviewed actions, privilege misuse, or execution of unsafe tasks discovered elsewhere in the workflow, especially when combined with heartbeat-driven operation.
- Content
md ## Key Principles ### Self-Service If it's in Ready, any agent can pick it up. No approval needed. ### Clear Ownership Every phase has ONE owner. No ambiguity.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
This template explicitly instructs the agent to operate autonomously by checking queues, spawning other agents, and continuing work without waiting for human direction. In an agent skill, that creates a real autonomy risk because it can trigger actions and delegation loops without fresh user authorization or clear execution boundaries.
- Content
md | Bad | Why | Fix | |-----|-----|-----| | Return HEARTBEAT_OK without checking | Loop dies silently | Actually run the checklist | | Do the work yourself instead of spawning | You become the bottleneck | Spawn specialists | | Ask "what's next?" | That's the team's job to figure out | Check backlog, spawn who's needed | | Wait for human direction | Defeats autonomy | Execute from Ready queue |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Notes - **Ready = fair game** — Any agent can claim without approval - **Pick top-down** — High priority before medium before low - **First claim wins** — If conflict, whoever claimed first keeps it - **Size guide** — S (<1h), M (1-4h), L (4h+)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Notes - **Ready = fair game** — Any agent can claim without approval - **Pick top-down** — High priority before medium before low - **First claim wins** — If conflict, whoever claimed first keeps it - **Size guide** — S (<1h), M (1-4h), L (4h+)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - [ ] Size estimated (S/M/L) - [ ] No blocking dependencies - [ ] Aligned with current sprint/strategy - [ ] Someone could pick this up without asking questions ---
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file instructs users to copy a process directory and append content into HEARTBEAT.md, both of which modify files in the user's workspace. The section does not include any warning that these commands will create or change local files, which is a relevant user-facing disclosure for markdown guidance that affects user data or workspace state.
- Content
Static analysis
No suspicious patterns detected.